CVE-2017-3966

Published: Apr 4, 2018Modified: Nov 21, 2024

6.3

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Exploitability: 2.8 / Impact: 3.4

Source: NVD

Description

Exploitation of session variables, resource IDs and other trusted credentials vulnerability in the web interface in McAfee Network Security Management (NSM) before 8.2.7.42.2 allows remote attackers to exploit or harm a user's browser via reusing the exposed session token in the application URL.

Affected (1)

Products: Mcafee: Network Security Manager

1 product

Network Security Manager

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mcafee Network Security Manager	Before 8.2.7.42.2

Related CWEs

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

References (2)

https://kc.mcafee.com/corporate/index?page=content&id=SB10192

Source: trellixpsirt@trellix.com

https://kc.mcafee.com/corporate/index?page=content&id=SB10192

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.